PT-2008-1136 · Gnu+1 · Bash+2
Dmitry E. Oboukhov
·
Published
2008-12-08
·
Updated
2013-04-19
·
CVE-2008-5374
CVSS v2.0
6.9
Medium
| Vector | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
bash-doc versions 3.2
bash versions prior to 4.2 p37
Description
The issue allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the aliasconv.sh, aliasconv.bash, and cshtobash scripts. Multiple vulnerabilities in the bash package can lead to disruption of confidentiality, integrity, and availability of protected information, and exploitation can be done locally.
Recommendations
For bash-doc version 3.2, consider restricting access to the aliasconv.sh, aliasconv.bash, and cshtobash scripts until a patch is available.
For bash versions prior to 4.2 p37, update to version 4.2 p37 or later to resolve the issue. As a temporary workaround, consider disabling the vulnerable scripts until a patch is available.
Fix
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Bash
Bash-Doc